Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Dovecot IMAP Server Denial of Service Risk
published 3 months ago
Summary
A security update is available for Dovecot's IMAP server, which could allow an attacker to crash the server. This affects Linux and other UNIX-like systems. It's essential to update Dovecot to the latest version to prevent this issue.
What to do
- Update almalinux dovecot to version 1:2.3.16-8.el8_10.
- Update almalinux dovecot-devel to version 1:2.3.16-8.el8_10.
- Update almalinux dovecot-mysql to version 1:2.3.16-8.el8_10.
- Update almalinux dovecot-pgsql to version 1:2.3.16-8.el8_10.
- Update almalinux dovecot-pigeonhole to version 1:2.3.16-8.el8_10.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| AlmaLinux:8 | almalinux | dovecot |
< 1:2.3.16-8.el8_10 Fix: upgrade to 1:2.3.16-8.el8_10
|
| AlmaLinux:8 | almalinux | dovecot-devel |
< 1:2.3.16-8.el8_10 Fix: upgrade to 1:2.3.16-8.el8_10
|
| AlmaLinux:8 | almalinux | dovecot-mysql |
< 1:2.3.16-8.el8_10 Fix: upgrade to 1:2.3.16-8.el8_10
|
| AlmaLinux:8 | almalinux | dovecot-pgsql |
< 1:2.3.16-8.el8_10 Fix: upgrade to 1:2.3.16-8.el8_10
|
| AlmaLinux:8 | almalinux | dovecot-pigeonhole |
< 1:2.3.16-8.el8_10 Fix: upgrade to 1:2.3.16-8.el8_10
|
Original advisory text
Important: dovecot security update
Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages.
Security Fix(es):
* dovecot: Dovecot: Denial of Service via excessive IMAP bracing (CVE-2026-42006)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Security Fix(es):
* dovecot: Dovecot: Denial of Service via excessive IMAP bracing (CVE-2026-42006)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://access.redhat.com/errata/RHSA-2026:46532 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-42006 Third Party Advisory
- https://bugzilla.redhat.com/2476476 Third Party Advisory
- https://errata.almalinux.org/8/ALSA-2026-46532.html Vendor Advisory
Timeline
Published27 Jul 2026
Updated28 Jul 2026
First seen28 Jul 2026
Sources
ALSA-2026:46532 · OSV
Track software like this
Free during beta